Western governments and intelligence agencies allege that Russian military or intelligence services organised acts of sabotage in Europe – including arson, assassination plans, railway damage, vandalism and electronic interference such as GPS jamming – as part of a hybrid war aimed at destabilizing countries that support Ukraine during the Russia–Ukraine war. European officials report that the number of suspected Russian sabotage incidents surged in 2023–2024, against infrastructure including gas pipelines and communication cables. Officials say the sabotage campaign is largely coordinated by Russian intelligence (GRU) and executed by covert operatives or locally recruited perpetrators, with Russian authorities denying responsibility. The Russian government denied conducting sabotage in Europe and blamed other actors for the incidents. In 2025, NATO described the level of sabotage threats as "record high" and stated that it viewed the Russian campaign of subversion as a serious security challenge to Europe.
Background
Russia has a history of covert operations and sabotage in Europe dating back to the Cold War, and its military doctrine has long emphasized targeting enemy infrastructure. In the 2010s, Russian operatives were implicated in isolated sabotage incidents, such as the 2014 Vrbětice ammunition depot explosions in the Czech Republic, which killed two people and were later attributed to agents of Russia's GRU (Unit 29155). According to Czech investigators, the GRU operatives (using the same cover identities later linked to the Skripal poisoning) coordinated the depot explosions, allegedly to disrupt arms supplies destined for Ukraine during the 2014 war in Donbas. The explosions led to a diplomatic rift, including mass expulsions of Russian diplomats from Prague and Moscow. After Russia's February 2022 full-scale invasion of Ukraine in February 2022, European governments began reporting a sharp increase in suspicious fires, infrastructure damage and other attacks, which they viewed as hybrid warfare. Many of these incidents were initially unexplained or treated as accidents, but came to be seen as possible acts of Russian sabotage as patterns emerged. By 2023, NATO and EU officials stated that Russia was waging a coordinated campaign of subversion and sabotage below the threshold of overt warfare, targeting Europe's critical infrastructure and civilian morale. The International Institute for Strategic Studies documented over 50 sabotage events in Europe from 2022 to mid-2025 that were likely linked to Russia. According to European security services, the sabotage campaign was deliberately done with low casualties and kept at a moderate level of destruction to reduce the risk of provoking a direct military response from NATO.
Types of sabotage and incidents
Energy and infrastructure
As of 2025, responsibility for the 26 September 2022 Nord Stream pipeline explosions was unclear. Some German officials advanced the theory that Russia had the motive of damaging its pipelines as a "false-flag" operation to drive a wedge between the west and Kyiv. Russian authorities accused the U.S. or the United Kingdom of destroying Nord Stream. This incident showed the vulnerability of European infrastructure to seabed warfare. US media reported that Ukraine had been behind the attack, a charge strongly denied by Kyiv. Subsequently Russia criticised German progress in Nord Stream sabotage inquiry accusing the country's authorities of having little interest in finding those responsible. Following the sabotage, NATO increased patrols around pipelines. In the Nord Stream sabotage, sections of the Nord Stream 1 and 2 gas pipelines from Russia to Germany were destroyed. Seismic monitors detected powerful underwater blasts, and investigators from Sweden concluded that the pipelines had been sabotaged using explosives.
In 2023–2024, undersea cables and pipelines in the Baltic Sea were severed or damaged, heightening suspicions of Russian sabotage. In October 2023, a subsea gas pipeline (the Balticconnector between Finland and Estonia) was ruptured concurrently with a data cable, in what Finland called a deliberate act, though investigations considered whether a vessel's dragged anchor caused the damage. in November 2024, two fibre-optic internet cables in the Baltic were severed within two days – one linking Finland to Germany and another linking Sweden to Lithuania's network. German and Finnish authorities described these as possible "intentional damage" to infrastructure. In late December 2024, an undersea power cable between Finland and Estonia (Estlink 2) was cut, along with several nearby telecom cables, causing blackouts and internet cuts. Finland seized a Russian-owned ship suspected of involvement, and regional leaders stated that the pattern of frequent undersea infrastructure "accidents" since 2022 was unlikely to be coincidental. Since 2022, European telecom operators in the Nordic-Baltic region have reported numerous cuts from unexplained cable severings and Western officials regularly cite Russia as the prime suspect.
Russian cyber units, often in coordination with physical sabotage efforts, targeted critical systems such as power plants since at least the mid-2010s.
Railway and transportation networks
European rail and transport infrastructure has been targeted. On 8 October 2022, unknown saboteurs severed two Deutsche Bahn fibre-optic cables in Germany, crippling the train signaling network in the north of the country and halting all long-distance and freight rail traffic for about three hours. German officials stated that striking redundant communication cables simultaneously showed that the sabotage required good knowledge of the system, and some raised suspicions of Russian involvement. A second act of cable sabotage occurred in Germany in December 2022, when cables were cut near the city of Essen, briefly disrupting a regional rail line.
Railway sabotage occurred in Poland, a key transit country for NATO military aid to Ukraine. In 2023, an arrest of a Russian spy ring in Poland was carried out that had allegedly been plotting sabotage of rail lines and arms transports. Polish prosecutors later announced that more than a dozen people, reportedly working for Russian intelligence, were charged with preparing acts of sabotage against Polish transport infrastructure and were found with hidden cameras monitoring railway lines used for Ukraine-bound shipments. NATO officials have acknowledged instances of train derailment attempts and other transit sabotage as part of the broader campaign to disrupt logistics.
On 16 November 2025, a suspected sabotage attack was carried out on sections of the Warsaw-Lublin railway near Mika, Masovian Voivodeship and Puławy, Lublin Voivodeship.
Arson attacks and urban sabotage
In the mid-2020s, a wave of arson and bomb hoaxes hit commercial or symbolic targets around Europe, in particular in Poland and Lithuania. On 8 May 2024, an IKEA store in Vilnius was set ablaze after closing hours. There were no injuries. Lithuanian prosecutors describe it as an act of "terrorism" by GRU. Two Ukrainian nationals were charged as the local perpetrators. One was arrested in Lithuania and the other in Poland. Investigators found they had been promised by Russian handlers to carry out bombing or fire attacks at shopping centres in Lithuania and Latvia.
On 11 May 2024, a massive fire destroyed the Marywilska 44 shopping centre in Warsaw, a market with over 1,000 shops, during the night, with no casualties. Polish investigators found that the blaze was the result of arson coordinated by Russian secret services: conspirators for hire had been paid to set the mall on fire. In 2025, evidence showed that the fire had been ordered by a GRU officer in Russia. Several people suspected to be locally recruited intermediaries in the Marywilska arson were arrested in Poland and Lithuania.
Lithuanian and Polish authorities considered it likely that the same Russian-linked network was behind both the Ikea fire and the Warsaw mall arson. In response, in May 2025 Poland expelled Russian diplomats and ordered the closure of Russia's consulate in Kraków.
Several incendiary attacks were recorded in Western Europe in the mid 2020s. In the United Kingdom, an arson plot targeted a factory and warehouse complex owned by a Ukrainian businessman in east London. On 20 March 2024, the facility, which had been involved in supplying protective gear to Ukraine, was set on fire, causing extensive damage. British police arrested a group of suspects and announced that the ringleader had been recruited online and directed by people linked to the Russian mercenary Wagner Group to carry out the arson. France experienced intimidation incidents in 2024 rather than outright attacks. In May, unknown vandals defaced a Holocaust memorial in Paris with pro-Russian graffiti. On 1 June 2024, early morning visitors to the Champ de Mars in Paris found five wooden coffins draped in French flags arranged at the foot of the Eiffel Tower. Each coffin was painted with the words "French soldiers in Ukraine". French authorities treated it as a hostile propaganda stunt. Three men, one of whom had ties to a pro-Russian extremist group, were arrested and charged with threatening national security. French intelligence suggested possible links between the two events as part of a Russian campaign of psychological pressure in France. The Russian government officially denied any connection to the Eiffel Tower coffins, dismissing it as a "provocation".
Other smaller-scale incidents attributed by Western officials to the sabotage campaign include vandalism or threats against politicians. In early 2023, Estonia's interior minister had his car windows smashed and a Molotov cocktail thrown at his property on the same night that a prominent investigative journalist's car was similarly vandalized. Estonia's security service attributed responsibility to Russian agents seeking to intimidate Ukraine supporters. In Germany, officials reported instances of suspected sabotage or spying around Bundeswehr bases involved in training Ukrainian soldiers, including unexplained small drones appearing over training ranges. On 26 June 2025, several Rheinmetall military trucks were set on fire at Erfurt and three of them destroyed in a suspected sabotage attack launched by Russian operatives.
Electronic interference (GPS and communications) On the day of Russia's invasion of Ukraine a cyberattack took place against the satellite internet system of American communications company Viasat which affected their KA-SAT network and triggered outages across central and eastern Europe (the Viasat hack). In May that year the European Union, the United States, and the United Kingdom condemned the attack as a Russian operation.
Russian sabotage includes GPS jamming and spoofing across Northern and Eastern Europe. Since 2022, Nordic and Baltic states lodged reports of strong interference with satellite navigation signals near their borders that affected civilian airliners, ships, and drones over broad areas. Finland's civil aviation authority stated that incidents of GPS outage attributable to jamming from across the Russian border significantly increased in frequency since the 2022 full-scale Russian invasion of Ukraine. In one high-profile case in April 2023, Finland's national airline Finnair had to suspend flights to the city of Tartu, Estonia, after multiple passenger planes experienced loss of GPS during approach, presumably due to Russian electronic interference in the region. Military exercises and civilian air traffic in the far northern areas of Norway and Sweden were repeatedly impaired by cross-border jamming signals originating from Kola Peninsula, where several Russian military bases are located.